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Calculation method for elliptic curve cryptography 

The invention relates to a cryptographic method 
employed between two entities exchanging information over 
a non- secure communication channel, for example a cable 
or radio network, the method assuring the confidentiality 
5 and the integrity of information transfer between the two 
entities. The invention relates more particularly to an 
improvement to cryptosystems employing calculations on an 
elliptic curve. The improvement mainly reduces the 
calculation time. 
10 The Dif f ie-Hellmann key exchange cryptographic 



protocol is used to exchange keys securely between two 
entities. Using it entails employing a group in the 
mathematical sense of the term. A group that can be used 
is constituted by an elliptic curve of the following 



y 2 + xy = x 3 + otx 2 +p 
It is known that if P = (x,y) is on the elliptic 
curve E, it is possible to define a "product" or "scalar 
multiplication" of the point P of E by an integer m. This 



15 



type : 



20 



operation is defined as follows: 



[m] P = P + P + P 



+ P (m times) 
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Doubling a chosen point P on this kind of elliptic 

curve in a Dif f ie-Hellmann key exchange algorithm is 

known in the art. This operation is known as "point 

doubling" and is part of an iterative double -and- add 

5 process. Any such doubling takes time. 

The slowest part of the Dif f ie-Hellman key exchange 

protocol is multiplying an unknown point on the curve by 

a random scalar. Only elliptic curves defined on a body 

of characteristic- two are considered here; this is a 

10 widely adopted implementation choice, because addition 
within a body of this kind corresponds to the " exclusive - 
or" operation. 

It is known in the art that multiplication by a 
scalar can be accelerated for curves defined on a body of 

15 low cardinality by using the Frobenius morphism. The 
curves can be chosen so that none of the known attacks 
applies to them. However, it is obviously preferable, at 
least in principle, to be able to choose the curve to be 
used from a class of curves that is as general as 

20 possible. The fastest version of the method in accordance 
with the invention is applied to half the elliptic 
curves. Moreover, from a cryptographic point of view, 
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that half is the best half. Before the theory of the 

method is described, the basic concepts are reviewed. 

For simplicity, consider the elliptic curve (E) 
that can be represented geometrically and is defined for 
the set R of real numbers by the equation y 2 + y = x 3 - x 2 
shown in figure 1, in which figure a horizontal line 
represents an integer number m, a vertical line 
represents an integer number n and each intersection of 
horizontal and vertical lines represents the integer 
coordinate pair (m, n) . 

(E) passes through a finite number of points with 
integer coordinates and any secant at (E) originating 
from any such point intersects (E) at two points, which 
may be coincident (in the case of tangents to the curve) . 

The addition operation applied to any two of these 
points A and B is defined as follows: let B 1 be the point 
at which the straight line segment (AB) intersects (E) ; 
the vertical through Bi intersects (E) at C = A + B. 

In the special case where (AB 1 ) is tangential to 
(E) , C 1 is the required sum. 

The "intersection of all verticals" point O is 
referred to as the point at infinity of (E) and is the 
neutral element of the addition defined in this way 
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since, by applying the geometrical . construction which 

defines the addition: 

A+O = O+A = A 

The doubling of A, which is denoted [2] A and 
5 defined as: A + A, is therefore the point B', the 
straight line segment (Ax) being tangential to (E) at A. 

By applying the addition of A construction to the 
point B 1 , the point [3]A is obtained, and so on: this is 
the definition of the product [n] A of a point by an 
10 integer. 

The present invention in fact relates to a family 
of elliptic curves which cannot be represented 
geometrically but are defined as follows: 

Let n be a given integer, F 2n the body of 2 n 

15 elements, and F 2n its algebraic closure. Let O be the 
point at infinity. The non-supersingular elliptic curve E 
defined at F 2D is: 

E = {(x,y)e F 2D X F 2n ly 2 + xy = x 3 + ox 2 + p} u {0} a, p e F 2 n , p * 0 
The elements of E are usually referred to as 
20 "points". It is well known in the art that E can be given 
an abelian group structure by taking the point at 
infinity as a neutral element. Hereinafter, the finite 
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subgroup of rational points of E is considered, and is 

defined by: 

E(F 2D ) = {(x,y)e F 2n X F 2D ly 2 + xy = x 3 + ox 2 + p} u {0} a, M F 2 n , p * 0 

where N is the set of natural integers; for all me N, 

5 the "multiplication by m" application in E is defined by: 

[m] : E ->E 

P^P + + P (m times) and VPeE:[o]P=0 

E [m] is the kernel of the application. The 
points of the group E [m] are called the m-torsion points 
10 of E . The group structure of the m-torsion points is well 
known in the art . 

In the situation in which m is a power of 2 : 
Vke N:E[2 k ]=Z/2 k Z 
where Z is the set of relative integers. 
15 Because E ( F 2D ) is a finite sub-group of E, there 

exists k 1 > 1 such that E [2 k ] is contained in E ( F 2D ) if 
and only if k < k 1 . For the elliptic curves E for which 
k'=l, the structure of E ( F 2 „ ) is: 

E(F 2 „ ) = G x {O, T 2 } 
2 0 where G is an odd order group and T 2 designates the unique 
second order point of E. A curve of this kind is said to 
have a minimal two- torsion. 
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It is now possible to explain the object of the 
invention. Doubling is not inject ive when it is defined 
on E or E ( F „ ) , because its kernel is: E[2] = {O, T 2 } . 

Moreover, if the domain for defining doubling is 
5 reduced to an odd order sub-group G <= E ( F 20 ) doubling 

becomes bi j ective . 

As a result doubling allows an inverse application 
to the sub-group that is referred to hereinafter as 
halving : 

10 [1/2] : G->G 

P-^Q such that: [2] Q = P 

[1/2] P is the point of G to which the doubling 
application makes the point P correspond. 

For all k>l: 

mm -Bi 

represents k compositions of the halving 
application with itself. 

Generally speaking, the invention therefore 
provides a cryptographic method employed between two 
20 entities exchanging information via a non-secure 
communication channel, the method including a step of 
multiplying an odd order point of a non- supers ingular 
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elliptic curve by an integer, characterized in that, for 

exchanging information via the non- secure communication 

channel, the above step includes addition and halving of 

points of said elliptic curve, the addition of points is 

an operation known in the art, the halving of a point P 

is defined as the unique odd order point D such that [2]D 



= P, 



denotes the halving operation and 



P denotes 



the point D. 

The halving application is beneficial for the 
10 scalar multiplication of a point on an elliptic curve for 
the following reason: if affine coordinates are used, it 
is possible to replace all doublings of a point of a 
scalar multiplication by halvings of a point. 

The halving of a point is much faster to calculate 
15 that its doubling. From a cryptographic point of view it 
is good to be able to choose from the greatest possible 
number of curves and a curve is usually used for which 
the two-torsion of. E ( F 2n ) is minimal or isomorphic to 

Z/4Z. For a given curve F 2 „ the minimal two-torsion 
20 elliptic curves constitute exactly half of the set of 
elliptic curves defined on F 20 . This is why, although it 
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is not totally general, the fastest version of the method 

described applies to a good proportion of the curves in 

interest in cryptography. It can also be applied when the 

elements of the body are represented in a normal basis. 

In the case of a polynomial basis, the memory space 

required is of the order of 0(n 2 ) bits. 

Some examples are given hereinafter, with reference 
to the accompanying drawings, in which: 

[-] Figure 1 is a graph showing a very particular 
elliptic curve that can be represented geometrically and 
is used hereinafter to explain elementary operations 
employed in the context of the invention; 

[-] Figure 2 is a diagram showing exchanges of 
information in accordance with the invention between two 
entities ; 

[-] Figure 3 to 6 are flowcharts explaining some 
applications conforming to the invention; and 

[-] Figure 7 is a block diagram of another system 
for exchanging information between two entities A and B 
which can employ a cryptographic method according to the 
invention. 

We will show how to calculate [1/2] P e G from 
P G G. We will then show how to replace the doublings of 
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points by halvings to execute a multiplication by a 

scalar . 

We will use the usual affine representation of a 
point: P=(x,y) and the representation: (x, A, p ) with 

X p =x+y/x. 

We derive y = x (x + X p ) , which uses only one 

multiplication, from the second representation. 

By proceeding in this way, to multiply a point by a 
scalar, we save on multiplications by calculating 
intermediate results using the representation (x, X ) and 

the coordinate of the affine representation is determined 
only at the end of the calculation. 

A point P is halved in the following manner: 
Calculate [1/2] P from P. For this consider the two 

points of E: 

P = (x, y) = (x, x (x + \) ) , 

and Q = (u,v) = (u, u (u + X Q ) ) , 
such that: [2]Q = P. 

The formulas for doubling known in the art yield: 

(1) A Q = u + v/u, 

(2) x = A Q 2 + A Q + a , and 

(3) y = (x+u) A Q + x + v. 
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Multiplying (1) by u and inserting the value of v 

obtained in this way in (3), the above system becomes: 

v = u (u + A Q ) , 

A Q 2 + A q = oc + x, and 

5 y=(x + u)A Q + x + u 2 + uA Q = u 2 + x(AQ+l) 

or, since y = x (x + X p ) : 

(i) A Q 2 + A Q = a + x, 

(ii) u 2 = (x (A Q +1) + y = (A Q + X p + x + 1) , 

and 

10 (iii) v = u(u + A Q ) . 

Starting from P = (x,y) = (x, x (x + X p ) ) in affine 

coordinates or in the (x, X- p ) representation, the above 
system of equations determines the following two types: 

[1/2] P GG and [1 [/2] P + T 2 e E ( F 2 „ ) \ G 
15 which give P by doubling. The following property enables 

it to be distinguished. 

Let E be a minimal two-torsion elliptic curve and 

P e E(F 2n ) = G x {O, T 2 } one of its odd order elements. 

Let Q e{[l/2] P, [1/2] P+ T 2 } and let Q x be one of the two 
20 points of E such that [2]Q X = Q. 

We have the necessary and sufficient condition: 

Q + [1/2] P«Q! € E(F 2D ) (a) 
We deduce from this that it is possible to check if 

Q = [1/2] P by applying the formulas (i) , (ii) and (iii) 
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to Q and verifying if one of . the points obtained belongs 
to E ( F 2 „ ) . 

We can extend this process to an elliptic curve 
E ( F 2D ) = G x E [2 k ] that is arbitrary by applying the 

5 formulas (i), (ii) and (iii) k times: the first time to 
Q, to obtain a point Qi such that [2] Qi = Q; the ith time 
to Qi-i to obtain a point Qi such that [2] Q± = Qi-i. The 
resultant point Q k will be of the form: 

-^yj P + T 2k+1 if and only if Q = [1/2] P + T 2 and will be of 

10 the form: 

, j P+T 2i with 0 < i < k if and only if Q = [1/2] P. We 

therefore have the necessary and sufficient condition: 

Q = [1/2] P O Q K e E(F 2D ) 
This process is evidently lengthy if k is large. 
15 The above equation (a) shows that we can determine 

whether Q = [1/2] P or Q = [l/2]P + T 2 by examining if the 
coordinates of Qi belong to F 2 „ or to a super-body of F 2 „ . 

As Qi is determined by the equations (i) , (ii) and (iii) , 
we have to study the operations used in solving these 
20 equations, which are not internal to the body but have 
their result on a super-body of F 2D . The only possible 
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instance is that of solving the second degree equation 

(i) : we must also calculate a square root to calculate 

the first coordinate of Qi, but in characteristic- two 

finding the square root is an operation internal to the 

body . Thus : 

Q = (u, v) = [1/2] P 3Xe F 2D : X 2 + X = a + u 

Because finding the square root is internal to the 
body, this necessary and sufficient condition can also be 
written : 

q = ( U , v) = [1/2] p <=> 3Ae F 2D : X 2 + X = a 2 + u 2 

The preceding relation is used to optimize the 

algorithm referred to below in instances where the square 

root calculation time is not negligible. 

For P gG, the two solutions of (i) are X [i/2]p and 

X [!/ 2 ]p + 1 and we deduce from (ii) that the first 

coordinates of the associated points are u and (u + Vjc ) . 

We can therefore deduce an algorithm for calculating 

[1/2] P in the following manner: 

If F 2D is a finite body of 2 n elements, E ( F 2 „ ) is 

the sub-group of an elliptic curve E defined by: 

E(F 2D ) = {(x,y)e F 2D X F 2 „ |y 2 + xy = x 3 + Ox 2 + p} U {0} a, 

p e F 20 , p * 0, 

12 



Application No. 09/786,756 
Amendment Dated June 1 3, 2005 
Reply to Office Action of February 1 1 , 2005 
Replacement Specification Sheet 

and E[2 k ] is the set of points P of said elliptic curve 

such that P added 2 k times to itself gives the neutral 

element 0 when k is an integer greater than or equal to 1 

then a point P = (x,y) of said elliptic curve yields by 



5 said halving the point j^-J P = (u 0/ v Q ) of said elliptic 

curve, obtained by effecting the following operations 
illustrated by the figure 3 flowchart: 

• seek a first value X 0 such that X 0 2 + 7^ = a + x 

• calculate a second value u Q 2 such that u Q 2 = x (X 0 + 1) 
10 + y 

• if k has the value 1, check if the equation: X 2 + X = 
a 2 + u 0 2 has solutions in F 2 „ , 

• if so, calculate said halving as follows: 

u 0 = V U Q 2 
15 v 0 = u 0 (u 0 + A^) 

and P = (u 0 , v 0 ) 

• if not, add x to said second value u 0 2 and 1 to said 



first value ^o and calculate said halving as in the 
directly preceding operation; 
20 • if k is greater than 1, perform the following iterative 
calculation : 

seek a value X± such that X ± 2 + X± = a + Ui_i 
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then calculate the value u 2 i such that u 2 i = ui_i {X± + 

+ Ui_i +1) 

by incrementing i from i = l until the value u k _i 2 is 
obtained 

• check whether the equation X 2 + X = a 2 + -u 2 k-i has 
solutions in F 2 „ 

• if so, calculate said halving is as follows: 

= V u o 2 
v 0 = u 0 (u 0 + X 0 ) 

n 

— P = (u 0/ v 0 ) 
.2j 

• if not, add x to the second value u 0 2 and 1 to said 



and 



first value Xo to calculate said halving as in the 
preceding operation. 



If we choose to represent the point ^ j P = (u 0/ v 0 ) 

of the elliptic curve by (u Q , X 0 ) with Xo = u 0 + v o /u 0/ then 
the algorithm conforms to the figure 4 flow chart: 

• seek a first value such that Xq 2 + Xo = oc + x 

• calculate a second value u Q 2 such that u Q 2 = x (A^ + 1) + 



if k has the value 1, check if the equation: X + = 
a 2 + u 2 0 has solutions in F 2 „ , 

• if so, calculate said halving as follows: 
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u 0 = V U o 2 

and: = ^ u °' ^ 

• if not, add x to said second value u c 2 and 1 to said 

first value Xo to calculate said halving as in the 
preceding operation; 

• if k is greater than 1 perform the following an 
iterative calculation : 

seek a value X± such that X 2 + X± = a + ui-i 

then calculate the value ui 2 such that Ui 2 = Ui_i (X± 
+ A,i-i + Ui_i + 1) 

incrementing i from i = l until the value u\-i is obtained 

• check if the equation X 2 + X = a 2 + u\-i has solutions 
in F 20 

• if so, calculate said halving as well as follows: 
= V u o 2 



U 0 

and 



P = (u 0f Ao) 



_2_ 

• if not, add x to said second value u 0 2 and 1 to said 
first value A*> to calculate said halving as in the 
preceding operation . 

If we choose to represent the point P = (x,y) by 

(x, A p ) setting X p - x+y/x which gives by said halving 
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the point = ( u o/V 0 ) of said elliptic curve, then the 

algorithm conforms to the figure 5 flow chart: 

• seek a first value X 0 such that X*> 2 + Xo = a + x 

• calculate a second value u Q 2 such that u Q 2 = x (Xq + Xp + 
5 x + 1) 

• if k has the value 1, check if the equation: X 2 + X = 
a 2 + u 0 2 has solutions in F 2 „ , 

• if so, calculate said halving as follows: 

u 0 = V u o 2 
10 v 0 = u 0 (u 0 + X, Q ) 



and: | — | P = (u 0/ v 0 ) 

• if not, add x to said second value u 0 2 and 1 to said 

first value X^ to calculate said halving as in the 
preceding operation; 
15 • if k is greater than 1 perform the following an 
iterative calculation : 

seek a value X± such that X± 2 + X± = a + ui_i 

then calculate the value u 2 i such that u 2 i = ui_i (X± 
+ A,i.i + ui-i + 1) 

20 incrementing i from i = l until the value u 2 k _i is obtained 

• check if the equation X 2 + X = a 2 + u 2 *.! has solutions 
in F 2 „ 

• if so, calculate said halving as well as follows: 
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Uo = V U 0 2 

v 0 = u 0 (u 0 + Xq) 
and j^j p = ^ u O' Vo) 
• if not, add x to said second value u G 2 and 1 to said 



first value Xo to calculate said halving as in the 
preceding operation. 

Finally, if we choose to represent the point P= 
(x,y) by (x, Xp) with 



Xp = x + y/x which gives by said halving the point 



P = 



10 (u 0/ v 0 ) of the elliptic curve represented by (u 0/ Xo) with 

Xo - u 0 + v 0 /u 0 then the algorithm conforms to the figure 6 
algorithm: 

• seek a first value A G such that X 0 2 + ^ = a + x 

• calculate a second value u Q 2 such that u Q 2 = x (^ 0 + Xp + 
15 x + 1) , 

• if k has the value 1 check if the equation X 2 +X = a 2 
+ u 0 2 has solutions in F 2D , 

• if so, calculate said halving as follows: 



u 0 = V""o 2 
1 



2 0 and 



P = (u 0 , Xo) 
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• if not, add x to said second value u 0 2 and 1 to said 
first value Xq to calculate said halving as in the 
preceding operation; 

• if k is greater than 1 perform the following iterative 
calculation : 



then calculate the value u 2 ± such that u± 2 = ui-i (X± 
+ A,i-i + ui-i + 1) 

incrementing i from i = l until the value u\_i is obtained 
• check if the equation X 2 + X = a 2 + u 2 k _i has solutions 



• if not, add x to said second value u 0 2 and 1 to said 
first value Xo to calculate said halving as in the 
preceding operation . 

We next describe how to perform the check, solve 
the second degree equation and calculate the square root 
in the algorithm for halving a point rapidly. We consider 
the normal basis and the polynomial basis. 



seek a value A± such that Aj. 2 + X± = a + Ui_i 



in F 2n 



• if so, calculate said halving as follows: 
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The normal basis results are known in the art. We 
can consider F 2B as the n-dimensional vectorial space on 

F 2 . In a normal basis, an element of the body is 
represented by: 

x=f Xi p 2i x ie {0,l} 
where f3eF 2D is chosen such that: ^,j3 2 ,...,p 2n * } is a basis F 2n . 

In a normal basis, the square root is calculated by a 
left circular shift and squaring is effected by a right 
circular shift. The corresponding calculation times are 
therefore negligible . 

If the second degree equation: X 2 + X - x has its 
solutions in F 2 „ , a solution is then given by: 

n-l i 

^ = X^iP 2 ' wi th: Ai= J xi 1< i < n - 1 

i=l k=l 

The time to calculate X is negligible compared to 
the time to calculate a multiplication of an inversion in 
the body. As the time to calculate a solution of the 
second degree equation is negligible, the check can be 
effected as follows: calculate a candidate X from x and 
check if X 2 + X = x. If not, the equation has no 
solution in F 2 „ . 
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In a polynomial basis, the following representation 

is used: 



x 



u — i 

= ^XjT 1 with xi e{0,l}. The square root of x can be 



calculated by storing the element Vf if we note that : 

- in a body of characteristic- two, the square root 
is a morphism of the body, 

V ^■'i even ' even 1 

Grouping in x the even and odd powers of T and 
taking the square root, this becomes: 



i-\ 
2 



10 = 2 x i T 2 + X ' T 

i even i odd 

so that, to calculate a square root, it is sufficient to 
"reduce" two vectors by half and therefore to execute a 
multiplication of a previously calculated value by an 
element of length n/2 . This is why the time to calculate 
15 a square root in a polynomial basis is equivalent to half 
the time to calculate a multiplication in the body. 

For the check and for solving the second degree 
equation, we consider F 2D as a n-dimensional vectorial 

space on F 2 . The application F defined as follows: 

20 F : F 2 , -» F 2 „ 

X -> X 2 + X 
is then a linear kernel operator {0, 1} 

20 
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For a given x, the equation X 2 + X = x has its 
solutions in F 2D if and only if the vector x is in the 

image of F. Im(F) is an (n - 1) -dimensional sub-space of 
F 2 „ . For a given basis of F 2 „ and the corresponding scalar 
product there exists a single non-trivial vector 
orthogonal to all the vectors of Im(F). Let w be that 
vector. We have: 

3X e F r : >l 2 + ^ = x<=>x»w=0 

Accordingly, the check can be performed by adding 

the components of x to which components of w equal to 1 
correspond. The time to perform this check is negligible. 

To solve the second degree equation: F(A,) = X 2 + X = 
x in a polynomial basis, we propose a simple and direct 
method which imposes the storage of an n x n matrix. For 
this we look for a linear operator G such that: 

Vxelm(F) :F(G(x))=(G(x)) 2 + G(x)=x 
Let ye F 2 n k e a vector such that y£lm(F) and define G as 
follows: 

G = F _1 with f(t')= f y if: i= 0 

1 F(r) if: l<i<n-l 
Given that x = ^"~*x i F(T i )eJm(F) then G(x) is a 

solution of the second degree equation. One 
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implementation consists of precalculating the matrix 

representing G in the basis {l/T, „.., T 11 " 1 } . In 

characteristic-two, the multiplication of a matrix by a 

vector is reduced to adding columns of the matrix to 

which a component of the vector equal to 1 corresponds. 

It follows that this method of solving a second degree 

equation consumes on average n/2 additions in the body 

F 2 „. 

Application of the principles explained above to 
scalar multiplication is described below. 

Let Pe E(F 2n ) be a point of odd order r, c a random 

integer and m the integer part of log 2 (r) . We calculate 
the product [c] P of a point by a scalar using the 
application for halving a point. 
We show that : 

For any integer c, there is a rational number of the 

form: 

such that : 

i=0 2 

Let <P> be the cyclic group generated by P. Because of 
the ring i somorphi sm : 
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p 



Z/rZ 



[k]P 



k 



The scalar multiplication can be calculated as follows: 



using halving and addition. We can use the double -and- add 
algorithm well known in the art for these calculations. 
For that it is sufficient to replace doubling by halving 
in the algorithm. It is necessary to execute log 2 (r) 
halvings and, on average, 1/2 log 2 (r) additions. There 
are improved versions of the double -and- add algorithm 
which require only 1/3 log 2 (r) additions on average. 

Consequently, a scalar multiplication using a 
halving as defined above is obtained by means of the 
following operations : 

- if said scalar of the multiplication is denoted S, 
choose m+1 values 

So... Sm G {0,1} to define S as follows: 



- r being the aforementioned odd order and m being 
the single integer between log 2 (r) -1 and log 2 (r), 



point P of said elliptic curve by the scalar S by 
applying an algorithm consisting of determining the 





calculate the scalar multiplication [S] P of a 
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series of points (Q m +i/ Qm»., Qi»., Qo) of said elliptic 

curve E such that : 

Qm+i = O (neutral element) 
Qi = [Si] P + ^j^i + 1 with o < i < m 
calculate the last point Q Q of said series giving 

the result result Q^-IJq. , we use the following 

algorithm, which is a slightly modified version of the 

standard algorithm : 

Input: P = (x,y) in affine coordinates and Q = (u, 
u(u + Xq) ) represented by (u, Kq) 
Output: P + Q = (s, t) in affine coordinates 
algorithm : [S] P of said scalar multiplication. 

To add the initial point P to an intermediate 

y + u(u + A, 0 ) 

1. Calculate: X = - 21 

x + u 

2. Calculate: s = A, 2 +X+a+x H-u 

3. Calculate: t = (s + x)A, + s + y 

4 . Result : (s , t ) 

This algorithm uses one inversion, three 
multiplications and one square root. 

Much time is saved by replacing doubling by 
halving. In affine coordinates, doubling and addition 
both require: one inversion, two multiplications and a 
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square root. If the scalar of the multiplication by a 

scalar is represented by a bit vector of length m and of 

k non-zero components, scalar multiplication requires: 



operation 


double and add 


halve and add 


inversions 


m + k 


k 


multiplications 


2m + 2k 


m + 3k 


squarings 


m + k 


k 


solutions of 
^, 2 +A,=a+x 


0 


m 


square root s 


0 


m 


checks 


0 


m 



5 

Thus using halving saves m inversions, m-k 
multiplications and m squarings at the cost of adding m 
second degree solutions, m square roots and m checks. 

In a polynomial basis, an execution time 
10 improvement of around 5 0% can be obtained. 

In a normal basis, we estimate the time to 
calculate the square root, perform the check and solve 
the second degree equation negligible compared to the 
time to calculate a multiplication or an inversion. 
15 Assuming further that the time to calculate an inversion 
is equivalent to the time to calculate three 
multiplications, we arrive at an execution time 
improvement of 55%. 
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Figure 2 is a diagram showing one possible 

application of the algorithms described above between two 

entities A and B exchanging information over a non- secure 

communication channel. Said communication channel can 

5 consist of simple electrical connections established 

between the two entities for the time of a transaction. 

It can also include a radio and/or optical 

telecommunication network. In this instance the entity A 

is a microcircuit card and the entity B is a server. Once 

10 connected to each other via said communication channel, 

the two entities apply a common key construction 

protocol. For this purpose: 

- entity A has a secret key a 

- entity B has a secret key b 

15 They must generate a secret key x known only to 

them from a public key consisting of a point P of odd 
order r of a chosen non- supersingular elliptic curve E. 

The protocol employed is a Dif f ie-Hellman protocol, 
substituting for the usual "multiplicat ion-by- two" 
2 0 referred to as the doubling operation in accordance with 
the invention described above and referred to as 
"halving" . 

The algorithm for this is as follows: 
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- the first entity (for example A) calculates the 
scalar multiplication [a] P and sends the result point to 
the second entity, 

- the second entity (B) calculates the scalar 
multiplication [b] P and sends the result point to the 
first entity, 

- the two entities respectively calculate a common 
point (C) = (x,y) of said elliptic curve (E) by 
respectively effecting the scalar multiplications 
[a] ( [b] P) and [b] ( [a] P) , both equal to [a.b]P, and 

- the two entities choose as their common key the 
coordinate x of said common point (C) obtained by said 
scalar multiplication [a.b]P, at least one of the 
preceding scalar multiplications, and preferably all of 
them, being effected by means of predefined halvings. 

To give a more precise example of this, figure 7 
shows a server B connected to a communication network 1 
via a communication interface 2, for example a modem 
interface. Similarly, a calculation station 3 is 
connected to the network 1 via a communication interface 
4. The station 3 is equipped with a microcircuit card 
reader 5 into which the microcircuit card A is inserted. 
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The random access memory 6 of the server B contains 

a program 7 capable of executing cryptographic 

calculations on elliptic curves and in particular the 

product of a point by a scalar and the halving of a 

5 point . 

The card A contain a central processor unit 11, a 
random access memory (RAM) 8, a read-only memory (ROM) 9 
and an electrically erasable programmable read-only 
memory (EE PROM) 10. One of the memories 9 or 10 contains 
10 a program 12 capable of executing cryptographic 
calculations on elliptic curves and in particular the 
product of a point by a scalar and the halving of a 
point . 

The two programs 7 and 12 have a common reference 
15 consisting of the same elliptic curve (E) and the same 
point P=(x 0 , y 0 ) of (E) . 

When A wishes to construct in parallel with B a 
common secret key for securing dialog with B, it chooses 
a scalar a and sends to B the product Q= [a] P= (x x , yi) . In 
20 response to this, B chooses a scalar b and sends back to 
A the product R= [b] P = (x 2/ y 2 ) . 
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A then calculates the product [a] R = [ab] P = 

(x, y) and B calculates the product [b] Q = [ab] P = 

(x, y) and A and B adopt x as a common secret key. 

These operations are represented in the table 

below. Those which are effected in the server B are 

indicated in the right-hand column and those which are 

effected in the card A are indicated in the left-hand 

column. The horizontal arrows symbolize transfers of 

information via the network 1. 

© © 

P = (x 0 , y 0 ) P = (x 0 , y 0 ) 

choice a 



15 Q = [a] P = <x 1# Yl ) 



choice b 
R = [b] P = (x 2 , y 2 ) 



[a]R = (x, y) [b] Q = (x,y) 

key = x key = x 



Another application of the invention applies 
between the two entities A and B in figure 7 . It consists 
of a protocol for signing a message M transmitted between 
A and B via the non- secure channel, i.e. the network 1. 
25 The object of this protocol, the broad outlines of which 
are known in the art, is to make it certain that the 
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message received by one entity was sent by the other 

entity. 

To this end, the sending entity (for example A) has 
two permanent keys, namely a secret key a and a public 
key Q = [a] P, P being a point on an elliptic curve (E) , 
and P and (E) being known to and agreed on by A and B . 
Another public key is the point P of odd order r of the 
chosen non-supersingular elliptic curve E. The operations 
effected entail halvings in the sense defined above. 

In one example: 

- the first entity (A) holding said pair of 
permanent keys constructs a single-use pair of keys, one 
key (g) chosen arbitrarily and the other key [g] P 
resulting from scalar multiplication of said arbitrarily 
chosen key (g) by the public point P of said elliptic 
curve, the coordinates of the key ( [g] P) being denoted 
(x,y) with 2 < g < r-2, 

- the first entity (A) converts the polynomial x of 
said single-use key [g] P = (x,y) into an integer i whose 
binary value is represented by the sequence of binary 
coefficients of said polynomial x, 

- said first entity (A) calculates a signature 
(c,d) of the message (M) as follows: 
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c = i modulo r 

d = g" 1 (M + ac) modulo r, 

- said first entity sends said message (M) and said 
signature (c, d) to said second entity; on receiving it: 

- said second entity (B) checks if the elements of 
said signature (c # d) each belong to the range [1, r-1] , 

- if not, it declares the signature invalid and 

stops 

- if so, said second entity (B) calculates three 
parameters : 

h = d" 1 modulo r 
hi = Mh modulo r 
h 2 = ch modulo r 

- said second entity calculates a point T of said 
elliptic curve by summing the scalar multiplications of 
the points P and Q by the last two parameters cited: 

T = [h x ] P + [h 2 ] Q 

if the resultant point T is the neutral element, 
said second entity declares the signature invalid and 
stops . 

if it is not the neutral element, considering the 
point T with coordinates x 1 and y 1 : T = (x 1 , y 1 ) : 

- said second entity (B) converts the polynomial x 1 
of that point into an integer i f whose binary value is 
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represented by the sequence of binary coefficients of 

said polynomial x 1 , 

- said second entity (B) calculates c 1 = i 1 modulo 
r , and : 

- checks that c ! = c: if so it validates said 
signature and if not it invalidates it, at least one of 
the scalar multiplication operations and preferably all 
of them being effected by means of the predefined 
halvings . 

These operations can be represented by the table 
below in which the operations effected in the server B 
are indicated in the right-hand column and the operations 
effected in the card A are indicated in the left-hand 
column, the arrow between the two columns symbolizing the 
transfer of information via the network 1. 
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